Analysis
-
max time kernel
150s -
max time network
150s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
19-01-2025 14:17
Behavioral task
behavioral1
Sample
hold.arm7.elf
Resource
debian9-armhf-20240729-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
hold.arm7.elf
-
Size
153KB
-
MD5
e4f7204d3431fb4bb48ab247f08505c5
-
SHA1
c824ea2861705f93410d157619690b1eb0a574ec
-
SHA256
cd72083d32d2efb6e016141e71b54d3ac540c6a9fd4979a88cb688aed7cee276
-
SHA512
891d0cd38615cbc8fde0e903343abe430a641cc05c49883b80d87e6c68e70eb8373e2e8b0b4d5e63ac24fd2f798d2425aad7751e80f4dc70c1002c2ba75e634e
-
SSDEEP
3072:MkwTyVP7jvOXB7ayLZhzXYhBLrAuS2NrGFWS4PRM/9UrPZ:MByVjKR7ayLZhzX8B+kGFWnpM/9UB
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 645 hold.arm7.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog hold.arm7.elf File opened for modification /dev/misc/watchdog hold.arm7.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog hold.arm7.elf File opened for modification /bin/watchdog hold.arm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ms334iu1gegc402u 645 hold.arm7.elf -
description ioc Process File opened for reading /proc/725/cmdline hold.arm7.elf File opened for reading /proc/137/cmdline hold.arm7.elf File opened for reading /proc/143/cmdline hold.arm7.elf File opened for reading /proc/640/cmdline hold.arm7.elf File opened for reading /proc/703/cmdline hold.arm7.elf File opened for reading /proc/5/cmdline hold.arm7.elf File opened for reading /proc/684/cmdline hold.arm7.elf File opened for reading /proc/701/cmdline hold.arm7.elf File opened for reading /proc/140/cmdline hold.arm7.elf File opened for reading /proc/727/cmdline hold.arm7.elf File opened for reading /proc/21/cmdline hold.arm7.elf File opened for reading /proc/642/cmdline hold.arm7.elf File opened for reading /proc/651/cmdline hold.arm7.elf File opened for reading /proc/694/cmdline hold.arm7.elf File opened for reading /proc/14/cmdline hold.arm7.elf File opened for reading /proc/109/cmdline hold.arm7.elf File opened for reading /proc/321/cmdline hold.arm7.elf File opened for reading /proc/700/cmdline hold.arm7.elf File opened for reading /proc/9/cmdline hold.arm7.elf File opened for reading /proc/12/cmdline hold.arm7.elf File opened for reading /proc/27/cmdline hold.arm7.elf File opened for reading /proc/654/cmdline hold.arm7.elf File opened for reading /proc/729/cmdline hold.arm7.elf File opened for reading /proc/4/cmdline hold.arm7.elf File opened for reading /proc/681/cmdline hold.arm7.elf File opened for reading /proc/706/cmdline hold.arm7.elf File opened for reading /proc/722/cmdline hold.arm7.elf File opened for reading /proc/299/cmdline hold.arm7.elf File opened for reading /proc/6/cmdline hold.arm7.elf File opened for reading /proc/584/cmdline hold.arm7.elf File opened for reading /proc/658/cmdline hold.arm7.elf File opened for reading /proc/685/cmdline hold.arm7.elf File opened for reading /proc/1/cmdline hold.arm7.elf File opened for reading /proc/707/cmdline hold.arm7.elf File opened for reading /proc/24/cmdline hold.arm7.elf File opened for reading /proc/16/cmdline hold.arm7.elf File opened for reading /proc/22/cmdline hold.arm7.elf File opened for reading /proc/42/cmdline hold.arm7.elf File opened for reading /proc/586/cmdline hold.arm7.elf File opened for reading /proc/664/cmdline hold.arm7.elf File opened for reading /proc/740/cmdline hold.arm7.elf File opened for reading /proc/2/cmdline hold.arm7.elf File opened for reading /proc/106/cmdline hold.arm7.elf File opened for reading /proc/598/cmdline hold.arm7.elf File opened for reading /proc/653/cmdline hold.arm7.elf File opened for reading /proc/656/cmdline hold.arm7.elf File opened for reading /proc/687/cmdline hold.arm7.elf File opened for reading /proc/20/cmdline hold.arm7.elf File opened for reading /proc/26/cmdline hold.arm7.elf File opened for reading /proc/98/cmdline hold.arm7.elf File opened for reading /proc/163/cmdline hold.arm7.elf File opened for reading /proc/669/cmdline hold.arm7.elf File opened for reading /proc/679/cmdline hold.arm7.elf File opened for reading /proc/10/cmdline hold.arm7.elf File opened for reading /proc/668/cmdline hold.arm7.elf File opened for reading /proc/730/cmdline hold.arm7.elf File opened for reading /proc/732/cmdline hold.arm7.elf File opened for reading /proc/652/cmdline hold.arm7.elf File opened for reading /proc/672/cmdline hold.arm7.elf File opened for reading /proc/726/cmdline hold.arm7.elf File opened for reading /proc/11/cmdline hold.arm7.elf File opened for reading /proc/728/cmdline hold.arm7.elf File opened for reading /proc/736/cmdline hold.arm7.elf File opened for reading /proc/678/cmdline hold.arm7.elf